CVE-2026-3219

MediumCVSS 4.6/10Last modified Jun 17, 2026

Description

pip handles concatenated tar and ZIP files as ZIP files regardless of filename or whether a file is both a tar and ZIP file. This behavior could result in confusing installation behavior, such as installing "incorrect" files according to the filename of the archive. New behavior only proceeds with installation if the file identifies uniquely as a ZIP or tar archive, not as both.

Metrics

CVSS 4.0 4.6/10

CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Weakness enumeration

CWE-434

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

No affected versions have been published.

Timeline

Published: Apr 20, 2026
Last modified: Jun 17, 2026
NVD status: Awaiting Analysis

Related CVEs from 2026

CVE-2026-321908.4Use after free in Microsoft Office allows an unauthorized attacker to execute code locally.CVE-2026-321919.8Improper neutralization of special elements used in an os command ('os command injection') in Microsoft Bing Images allows an unauthorized a CVE-2026-321927.8Deserialization of untrusted data in Azure Monitor Agent allows an authorized attacker to elevate privileges locally.CVE-2026-321938.8Improper limitation of a pathname to a restricted directory ('path traversal') in Microsoft Azure Kubernetes Service allows an authorized at CVE-2026-321949.8Improper neutralization of special elements used in a command ('command injection') in Microsoft Bing Images allows an unauthorized attacker CVE-2026-321957.0Stack-based buffer overflow in Windows Kernel allows an authorized attacker to elevate privileges locally.CVE-2026-321966.1Improper neutralization of input during web page generation ('cross-site scripting') in Windows Admin Center allows an unauthorized attacker CVE-2026-321977.8Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally.CVE-2026-321987.8Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally.CVE-2026-321997.8Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally.CVE-2026-32208.8The Autoptimize WordPress plugin before 3.1.15, Clearfy Cache WordPress plugin before 2.4.2, Speed Optimizer WordPress plugin before 7.7.9 CVE-2026-322007.8Use after free in Microsoft Office PowerPoint allows an unauthorized attacker to execute code locally.